CVE-2025-71422
Received Received - Intake

Contrast Kubernetes Runtime LUKS2 Volume Null Cipher Weakness

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a header specifying the null keyslot encryption algorithm (cipher_null-ecb) is accepted without error. Because the Contrast Initializer assumes a device is protected if `cryptsetup open` succeeds with the secret seed, the guest will open the attacker-supplied volume and write secret data in plaintext, or under a volume key known to the attacker, allowing the host to read confidential data that should have been encrypted. Contrast v1.12.1 ships cryptsetup 2.8.1, which disables null ciphers in keyslots when the passphrase is non-empty; v1.13.0 adds detached-header validation in guest memory and integrity protection for secure persistent storage. Contrast persistent volumes were not integrity protected, so integrity impact is not considered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2025-71422
EUVD
EUVD-2025-211010

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
edgelesssys contrast to 1.12.1 (exc)
edgelesssys contrast 1.12.1
edgelesssys contrast 1.13.0
cryptsetup cryptsetup to 2.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71422 affects Contrast, a Kubernetes runtime for confidential containers, in versions before 1.12.1. The vulnerability involves the secure persistent volume feature where a malicious host can supply a crafted LUKS2 volume with a null encryption algorithm (cipher_null-ecb) to a pod VM. Since LUKS2 metadata is not authenticated and older cryptsetup versions (<2.8.1) accept this header without error, the guest system opens the volume without proper encryption. Data is written in plaintext or under a known key, allowing the host to read confidential information.

Detection Guidance

Check Contrast version with `contrast version` or inspect Kubernetes pods for Contrast components. Verify cryptsetup version with `cryptsetup --version`; versions before 2.8.1 are vulnerable. Inspect LUKS2 volumes for null cipher keyslots using `cryptsetup luksDump <device>` and look for cipher_null-ecb in keyslot algorithms.

Impact Analysis

This vulnerability allows a malicious host with low privileges to read confidential data stored in persistent volumes that should have been encrypted. Attackers can access sensitive information in plaintext or decrypt it using a known key, compromising data confidentiality. The attack requires proximity to the target system but no user interaction.

Compliance Impact

This vulnerability likely violates compliance requirements for data encryption and confidentiality, such as GDPR's data protection principles and HIPAA's security rule for safeguarding protected health information. Unauthorized access to plaintext data or weak encryption undermines regulatory compliance for data security and integrity.

Mitigation Strategies

Upgrade Contrast to v1.12.1 or later and ensure cryptsetup is at least 2.8.1. For persistent volumes, enable detached-header mode and integrity protection. If using older versions, avoid storing sensitive data in Contrast persistent volumes until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart